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REMARKS 

The Examiner has indicated that the declaration under 37 CFR 1.131 is 
insufficient to overcome the rejections based on the Deri et al. and Conklin et al. 
references. In particular, the Examiner states that Exhibit A provides no description of 
"A method and system for receiving accounting information over a packet-switched 
network, monitoring at least one aspect of the received accounting information, and 
discarding at least a portion of the accounting information based on the monitored 
aspect." 

Applicant respectfully disagrees with such assertion. In particular, applicant 
points out the following excerpt from page 2 of Exhibit A: 

"The Technical Detail 

Below is a list of techniques that we will patent as being used to 
identify attacks from accounting data. More can be added, of 
course, to make this" as complete as possible and to prevent 
competition from suggesting a viable solution without infringing 
on our patent . 

• Detect port scan, either up or down. Be careful not to trigger 
a false alarm on OS-randomly-assigned source ports. 

• Detect IP scan. 

• Detect a surge in accounting traffic rate in ingress. In this 
case, count and discard records above a threshold. The attack 
is by the mere suggestion that this is not reflective of normal 
usage patterns," 

Such excerpt clearly teaches "a method and system for receiving accounting 
information over a packet-switched network, monitoring at least one aspect of the 
received accounting information over a packet-switched network (i.e. "detect a surge in 
accounting traffic rate " etc.), and discarding at least a portion of the accounting 
information based oh the monitored aspect (i.e. "count and discard records above a 
threshold," etc.) This is further supported by the declaration. Reconsideration is thus 
respectfully requested. 
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The Examiner is thanked for the thorough work and attention to detail in the 
previous action. 

The Examiner has further rejected Claims 1-4, 6-8, 10-17, and 20-22 under 35 
U.S.C. 102(e) as being anticipated by Conklin et al. (USPN 5,991,881). Applicant 
respectfully disagrees with this assertion, especially in view of the amendments made 
hereinabove. 

Specifically, the Examiner relies on the Abstract, Figs. 6-9, and Col. 1, line 10- 
Col. 2, line 4 to show applicant's claimed "discarding at least a portion of the accounting 
information that occurs during a surge in network traffic, based on the monitored aspect." 
The only explicit suggestion of any sort of "discarding," however, is found in col. 5, lines 
22-24, as follows: 

"Intrusion Detection- -Reportable Activity 

If, there is no indication of an actual or potential intrusion, 
then the examined packet data is discarded." 

Such excerpt, however, suggests the discarding of examined packet data, if there 
is no indication of an actual or potential intrusion . In sharp contrast, applicant teaches 
and claims "discarding at least a portion of the accounting information that occurs during 
a surge in network traffic " (emphasis added). Thus, applicant's claimed invention is 
adapted for discarding the actual accounting information associated with a surge in traffic 
(i.e. attack, etc.). in contrast to discarding examined packet data associated with a tack of 
an attack, as suggested by Conklin. Thus, the intrusion detection technique Conklin 
teaches away from applicant's claimed invention. Only applicant's claimed invention 
prevents performance degradation of downstream applications during a possible attack by 
simply discarding accounting information associated with a surge in network traffic, as 
claimed. 
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Simply nowhere in the prior art is there such a combination of features for 
fulfilling the foregoing objectives. 

Claim 23 has been amended to include the aforementioned limitations of the 
remaining independent claims. Thus, all rejections of the independent claims are thus 
deemed to have been overcome. By virtue of the dependence of the remaining claims, 
such remaining claims are also deemed allowable. 

A notice of allowance is respectfully requested. 

In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5 100. The 
Commissioner is hereby authorized to charge any fees that may be due or credit any 
overpayment to Deposit Account No. 50-1 351 (Order No. XACTP001). 



P.O.Box 721120 

San Jose, CA 95172-1120 

408-505-5100 
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